Memory images of computing devices (e.g., snapshots of all of the data stored on the devices at particular points in time) may be generated and/or analyzed by a variety of services. For example, security forensics systems and other security services may analyze an image of a computing device while attempting to identify a security breach or malfunction on the device. In particular, after a computing device experiences a performance and/or security failure, a security service may retrieve and/or copy all of the data from the computing device onto a separate device (e.g., a backend server or virtual machine) for analysis. The service may then analyze the re-created state of the computing device to identify a cause of the device's failure.
Unfortunately, traditional image-generating systems may be unable to efficiently and/or accurately generate memory images of computing devices. For example, the process of copying all of the data from a computing device to a separate server for analysis may interrupt normal operations of the device. Furthermore, such a process may disrupt data stored within the device that may indicate a cause of the device's malfunction. In addition, because the memory within a computing device may be constantly changing, a conventional image-generating technology that retrieves data from the device while the device is running may produce an inconsistent and/or inaccurate image of the device. For example, the data within an image created by a traditional image-generating service may represent various states of the computing device, rather than the state of the device at a single point in time. The current disclosure, therefore, identifies and addresses a need for improved systems and methods for generating memory images of computing devices.